CVE-2026-93808
NONE—CVSS v3
—CVSS v2
—
EPSS (exploit probability)
—CWE
Description
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: caiaq: validate EP1 reply lengths
usb_ep1_command_reply_dispatch() uses buf[0] as a command byte and then
reads command-specific fixed items from the same URB buffer. Several
paths use buf + 1, buf[1], buf[2], or buf + 3 without first proving that
urb->actual_length contains those bytes.
Add per-command length checks, use a payload length derived from the
bytes after the command byte for the control-state copy, and reject short
analog input payloads before the input helper reads fixed offsets from
the EP1 reply.
Affected routers (0)
No routers currently mapped to this CVE in our database.